ARP replies for VRRP IP answered with circuit MAC

Products

• XOS

Issue/Introduction

This article shows and explains the situation when the ARP reply packets leaving the APM can be transparently changed under certain circumstances.Symptoms:
1. "mac-usage vrrp-mac" is configured on circuit's virtual router
2. APM packet capture (tcpdump) shows that the ARP replies leaving the VRRP enabled circuit are carrying circuit MAC address instead of the (expected) VRRP MAC address. This is then transparently changed and NPM is already showing the expected VRRP MAC address.

	Source MAC	ARP reply payload
APM capture	00:03:d2:f1:01:01	10.1.1.1 is at 00:03:d2:f1:01:01
NPM capture	00:00:5e:00:00:01	10.1.1.1 is at 00:00:5e:00:00:01

Cause

Goal:
To explain this behavior.

Resolution

The observed behavior does not mean a problem and is purely cosmetic. The reason for it is that under certain circumstances the ARP replies for the ARP requests hitting the circuit's VRRP IP are changed by the VND driver after the packet is captured by the tcpdump. This causes the difference between the APM and NPM packet capture output.

Workaround

N/A